{"id":"CVE-2024-9070","kind":"vulnerability","aliases":["CVE-2024-9070","GHSA-9g44-gwvm-hc44"],"related":[],"title":"BentoML deserialization vulnerability","description":"A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.","summary":"BentoML's runner server deserializes request data when the args-number parameter is greater than 1, so an attacker who sends crafted parameters can execute arbitrary code on the server. The advisory gives a CVSS score of 9.8 and lists the affected range as up to 1.4.5, while the description names versions up to 1.3.4.post1.","severity":"critical","cvss":9.8,"epss":0.00931,"exploited":false,"exploited_at":null,"products":[{"name":"bentoml","fixed":[],"affected":"<= 1.4.5","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["bentoml","cwe-502","model-serving","package","python","self-hosted"],"not_affected_if":["version-above-1.4.5"],"how_to_check":"- Run `pip show bentoml` and compare the installed version with `1.4.5` and earlier releases\n- Check whether the runner server is reachable from untrusted networks, since the sources do not say which ports or paths are exposed by default\n- unknown whether the sources list a fixed version","fix":"- Upgrade `bentoml` to a release newer than `1.4.5`; the fixed version is unknown from the sources, so confirm it in the GHSA advisory\n- Restrict network access to the BentoML runner server until upgraded","status":"open","published_at":"2025-03-20T10:15:46+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","triaged_at":"2026-10-27T15:19:01+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T15:19:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `bentoml` to a release newer than `1.4.5`; the fixed version is unknown from the sources, so confirm it in the GHSA advisory\n- Restrict network access to the BentoML runner server until upgraded","reach":"unknown","title":"BentoML: runner server deserialization lets an attacker run code","impact":"high","summary":"BentoML's runner server deserializes request data when the args-number parameter is greater than 1, so an attacker who sends crafted parameters can execute arbitrary code on the server. The advisory gives a CVSS score of 9.8 and lists the affected range as up to 1.4.5, while the description names versions up to 1.3.4.post1.","category":"package","nicknames":[],"who_cares":["python","bentoml","model-serving","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the BentoML server","analyst_note":"Confirm the fixed version and whether the default configuration exposes the runner server; the sources conflict on the affected range (<=1.4.5 vs <=1.3.4.post1).","how_to_check":"- Run `pip show bentoml` and compare the installed version with `1.4.5` and earlier releases\n- Check whether the runner server is reachable from untrusted networks, since the sources do not say which ports or paths are exposed by default\n- unknown whether the sources list a fixed version","needs_analyst":true,"not_affected_if":["version-above-1.4.5"],"who_is_affected":"Teams running BentoML model-serving runners on a version at or below 1.4.5 are exposed, and the sources name the runner server as the component. Deployments where the runner server is not reachable from untrusted networks have less exposure. The sources do not say whether the default configuration is vulnerable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000665,"input_tokens":3373,"output_tokens":656,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':5A,13A '-502':18B '-9070':6A,14A '1':43B,128C '1.3.4':82B,96C '1.4.5':74B '9.8':65B '9g44':9A 'advisori':59B 'affect':69B 'arbitrari':53B,107C,134C 'arg':37B,122C 'args-numb':36B,121C 'attack':46B,103C 'automat':131C 'bentoml':1A,15A,16B,27B,89C 'bentoml/bentoml':94C 'caus':112C 'code':54B,108C,135C 'craft':49B 'cve':4A,12A 'cvss':62B 'cwe':17B 'data':33B 'descript':77B 'deseri':2A,31B,85C,132C 'execut':52B,105C,136C 'exist':87C 'ghsa':8A 'ghsa-9g44-gwvm-hc44':7A 'give':60B 'greater':41B,126C 'gwvm':10A 'harm':114C 'hc44':11A 'host':26B 'lead':129C 'list':67B 'model':20B 'model-serv':19B 'name':78B 'number':38B,123C 'packag':22B 'paramet':39B,50B,101C,124C 'post1':83B,97C 'python':23B 'rang':70B 'request':32B 'runner':29B,91C 'score':63B 'self':25B 'self-host':24B 'send':48B 'serv':21B 'server':30B,57B,92C,111C 'set':99C 'sever':113C 'specif':100C 'trigger':118C 'unauthor':106C 'version':79B,95C 'vulner':3A,86C,116C","nicknames":[],"mitigations":[],"who_affected":"Teams running BentoML model-serving runners on a version at or below 1.4.5 are exposed, and the sources name the runner server as the component. Deployments where the runner server is not reachable from untrusted networks have less exposure. The sources do not say whether the default configuration is vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:46+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9g44-gwvm-hc44","url":"https://github.com/advisories/GHSA-9g44-gwvm-hc44","severity":"critical","published_at":"2025-03-20T12:32:50+00:00","modified_at":"2026-10-27T15:14:58+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","fetched_at":"2026-10-27T15:18:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-9070","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9070","severity":null,"published_at":"2025-03-20T10:15:46+00:00","modified_at":"2026-06-17T08:23:53+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}